Overview

overview

10

Static

static

10

5024-11-0x...ry.exe

windows10-2004-x64

5024-11-0x...ry.exe

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5024-11-0x0000000000400000-0x0000000000442000-memory.dmp

  • Size

    264KB

  • MD5

    ade469a1cb23371e297a8aefa416ffe6

  • SHA1

    bf5998d8995b0e68c7a4787131a81189f2030b30

  • SHA256

    90b75d0e42b33febcc9d25dfb2c1dd4baaabf53f52ba03990935010136165c76

  • SHA512

    830a249bee3051bc32389c29a4b38b6dada928bdc3d26453d2284fb635cd19e0eb1a5e5b5a853ead1ea9456ea8c31a2c58d2b1fa981ceafc1bebceb65a011cfa

  • SSDEEP

    3072:IPBayiq6lEAKt9sOW1IkTHo9rG8KaG5jnThTq0ufzz:eayiq6bA+Zsq8KaWTZ

Score
10/10
agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.dorasanat.com.tr
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    #9e{{YWsO?~I

Signatures

  • Agenttesla family
    agenttesla
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 5024-11-0x0000000000400000-0x0000000000442000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections